A server farm is a physical location having a scalable infrastructure and facilities and resources enabling users connected to the Internet network to easily access a number of services provided by a plurality of customers hosted by the server farm. Generally, the resources are located in premises owned by a data processing equipment provider such as the IBM Corporation.
Most server farms are used today to host Internet related devices (for example WEB servers) of several customers. The architecture of such a server farm includes a local network to which are connected the customer cabinets and an Internet front-end connecting this local network to the Internet. Such a local network includes different layers of components such as switches and firewalls through which the requests from the users connected to the Internet are routed towards the customer cabinets.
The firewalls are intermediary devices between the local Network and the front-end. They are connected by a LAN to an Internet Access Router (IAR) which is directly connected to the Internet.
The firewalls present all the characteristics of a router with the addition of security filtering features known as firewall rules. Firewalls also have the capability to inspect IP packets and track the state of sessions going through the firewall and established between any of two devices separated by this firewall. This capability, which is known as “Statefull Inspection”, includes checking that every backward connection is associated with an existing forward connection and following the state of a connection to allow only packets that are in the right sequence level of the connection to proceed. This means that, if a connection is established from an end user to a WEB server (forward path) through a first firewall, all the responses coming from the WEB server to the end user (reverse path) will have to go through this firewall. If any firewall receives a reverse path frame without having received a forward path frame, it will drop the reverse frame. If any firewall receives a data packet while the session is only at the connecting state, it will drop the data packet.
In the local network, a protocol such as the Virtual Route Routing Protocol (VRRP) is used between the firewalls. VRRP allows the customer WEB servers to see the redundant firewalls as a single virtual firewall. At any instant and on a per customer basis, only one firewall really owns the virtual firewall function based on the availabilities of the firewall interfaces or on static priorities associated with them by configuration. The individual interface to a customer cabinet having the highest priority is the one elected to own the virtual firewall interface. The associated firewall acts as the virtual firewall until it fails or until another interface with a higher priority appears. A first firewall (also called the primary firewall) can own the virtual firewall function for a subset of the customer servers while the other firewall (also called the secondary firewall) can own this role for another set of customers. In other words, the first firewall owns the primary interface of the VRRP group of interfaces to each one of these customer servers.
In the context of the invention, the customer servers are not allowed to communicate with each other. However, the customer servers hosted in the cabinets can plug, and unplug the link to the firewalls on their own, thereby impacting all the other attached customer servers if all the customer servers were switched at once. There could be a situation where all the customer servers would flip-flop permanently between firewalls just because of one customer server putting its links up and down.
Accordingly, and as no connections between customer servers are allowed, the requirement is to switch only one customer server in case of link failure and to configure the firewalls so that one firewall is the primary firewall for half the customer servers whereas another firewall is primary for the other half of the customer servers. Sharing the initial load between the firewalls at startup time improves the response time and the performance of the system as it avoids end-to-end retransmission when a frame is lost in the firewall because of temporary congestion. Such a load sharing is done in configuring adequately the priorities of the different interfaces by VRRP in each firewall.
But there is still a problem if there is a failure of the interface between a customer server and the firewall which is the primary firewall for this interface. In such a case, the secondary firewall detects the failure by the internal mechanism of VRRP and becomes the primary firewall. Nevertheless, the traffic from the IAR to the customer server which keeps on using the first firewall is cut since the interface between this firewall and the customer server has failed. It is therefore necessary to force the traffic from the IAR to the customer server to be routed through the second firewall in order to preserve the symmetrical routing for this customer server.